From f264fbbf74224eb22de3106acb011ce5bd2b64a3 Mon Sep 17 00:00:00 2001 From: VizzleTF Date: Mon, 14 Sep 2026 13:53:32 +0300 Subject: [PATCH] chore: run owfeed v0.5.3 feed.yml@v0.5.3 and setup@v0.5.3 install the release they are pinned at, so intake.yml drops its separate version: and the uses: refs are the whole pin. --- .github/workflows/intake.yml | 8 +++----- .github/workflows/pr.yml | 2 +- .github/workflows/publish.yml | 2 +- RUNBOOK.md | 4 ++-- RUNBOOK_ru.md | 4 ++-- STATUS.md | 2 +- examples/gitlab-ci.yml | 2 +- 7 files changed, 11 insertions(+), 13 deletions(-) diff --git a/.github/workflows/intake.yml b/.github/workflows/intake.yml index 44c3aa6..d77904f 100644 --- a/.github/workflows/intake.yml +++ b/.github/workflows/intake.yml @@ -27,11 +27,9 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - # Both lines move together. setup defaults to "latest", not to its own tag, - # so the version stays explicit -- and dependabot moves only the uses: ref. - - uses: owfeed/owfeed/setup@v0.5.2 - with: - version: v0.5.2 + # No `version:`: since owfeed v0.5.3 setup installs the release it is pinned + # at, so this line is the whole pin and a dependabot bump moves the binary too. + - uses: owfeed/owfeed/setup@v0.5.3 - name: Read the request and answer it env: diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 187958d..3aded23 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -117,7 +117,7 @@ jobs: # tagged with, so this line is the whole pin. It used to be a second pin # beside it, and dependabot moved only this one -- the feed ran feed.yml@v0.5.1 # with an owfeed v0.4.5 binary from #65 until this line was fixed. - uses: owfeed/owfeed/.github/workflows/feed.yml@v0.5.2 + uses: owfeed/owfeed/.github/workflows/feed.yml@v0.5.3 with: dry-run: true pre-build: for d in packages/*/; do ./tools/fetch.sh "$d"; done diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c2a2b48..1289b32 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -38,7 +38,7 @@ jobs: # tagged with, so this line is the whole pin. It used to be a second pin # beside it, and dependabot moved only this one -- the feed ran feed.yml@v0.5.1 # with an owfeed v0.4.5 binary from #65 until this line was fixed. - uses: owfeed/owfeed/.github/workflows/feed.yml@v0.5.2 + uses: owfeed/owfeed/.github/workflows/feed.yml@v0.5.3 # So the publish job can read OWFEED_SIGN_KEY and OWFEED_USIGN_KEY from the # `feed` environment. They are environment secrets, not repository ones -- # the scheduled update job and every pull-request check are outside that scope diff --git a/RUNBOOK.md b/RUNBOOK.md index f20b7fd..a5039a2 100644 --- a/RUNBOOK.md +++ b/RUNBOOK.md @@ -69,8 +69,8 @@ A merge or a push made with `GITHUB_TOKEN` raises no `push` event either, which dispatched rather than triggered. `workflow_dispatch` is the documented exception in both cases: those events always create runs. -**How owfeed gets here.** `owfeed/owfeed/setup@v0.5.2`, pinned to a release. In `pr.yml` and -`publish.yml` the pin is the `uses: .../feed.yml@v0.5.2` line alone: that workflow installs the +**How owfeed gets here.** `owfeed/owfeed/setup@v0.5.3`, pinned to a release. In `pr.yml` and +`publish.yml` the pin is the `uses: .../feed.yml@v0.5.3` line alone: that workflow installs the owfeed release it is tagged with, so do not add `owfeed-version:` back. The action downloads one binary and checks it against the build attestation from owfeed's own release workflow before running it — not against a checksum from the same release, which whoever replaced the binary could diff --git a/RUNBOOK_ru.md b/RUNBOOK_ru.md index f300b21..7a22201 100644 --- a/RUNBOOK_ru.md +++ b/RUNBOOK_ru.md @@ -71,8 +71,8 @@ Push или мерж под `GITHUB_TOKEN` тоже не поднимает со вручную, а не по триггеру. `workflow_dispatch` — задокументированное исключение в обоих случаях: такие события всегда создают запуск. -**Как сюда попадает owfeed.** `owfeed/owfeed/setup@v0.5.2`, пин на релиз. В `pr.yml` и -`publish.yml` пин — одна строка `uses: .../feed.yml@v0.5.2`: этот workflow ставит тот релиз owfeed, +**Как сюда попадает owfeed.** `owfeed/owfeed/setup@v0.5.3`, пин на релиз. В `pr.yml` и +`publish.yml` пин — одна строка `uses: .../feed.yml@v0.5.3`: этот workflow ставит тот релиз owfeed, которым помечен сам, поэтому `owfeed-version:` обратно не добавляйте. Action скачивает один бинарь и сверяет его с build-аттестацией из релизного workflow самого owfeed до запуска — не с контрольной суммой из того же релиза, которую тот, кто подменил бинарь, подменил бы заодно. Раньше diff --git a/STATUS.md b/STATUS.md index e8327c1..227fa26 100644 --- a/STATUS.md +++ b/STATUS.md @@ -25,7 +25,7 @@ it is the last time the URL has to move. | | Evidence | |---|---| | Feed updates reaching a router | Upstream released 0.14.10 → the update bot opened #51 with the pins recomputed → a maintainer approved the held check and merged it → `Publish` → the served 25.12 index carries `0.14.10-r1`, read from a router. That was the path before #61; the row below is the same journey without a person | -| Publishing through owfeed's reusable workflow | `publish.yml` calls `feed.yml@v0.5.2` with `secrets: inherit`; a probe (at v0.5.0) measured that a called job's `environment: feed` resolves against this repository, and the signing secrets reached it at their real length | +| Publishing through owfeed's reusable workflow | `publish.yml` calls `feed.yml@v0.5.3` with `secrets: inherit`; a probe (at v0.5.0) measured that a called job's `environment: feed` resolves against this repository, and the signing secrets reached it at their real length | | An author signature inside every package | `signing.author-keys: ./keys` in `owfeed.yml`, one EC public half pinned per package; an unsigned package is dropped from the index (OWF407) and `tools/check-tree.sh` then fails the publish, so a green publish is the evidence | | Automatic-update tier rules | Six scenarios exercised in a real git repository: manifest/minor merges, major bump holds, `binaries` holds, no `SIG_KEY` holds, a diff touching `SIG_KEY_ID` holds, the daily ceiling holds | | Verify before read | `tools/fetch.sh` checks the signature before parsing, and cross-checks `repo` and `tag` inside the manifest — the signature says *who*, never *what about* | diff --git a/examples/gitlab-ci.yml b/examples/gitlab-ci.yml index 588ca95..15164e4 100644 --- a/examples/gitlab-ci.yml +++ b/examples/gitlab-ci.yml @@ -19,7 +19,7 @@ stages: [build, release] variables: # Pin a release. The tool that signs what you publish should move when you change # this line, not whenever owfeed is pushed to. - OWFEED_VERSION: "v0.5.2" + OWFEED_VERSION: "v0.5.3" build: stage: build